AI agents scale and speed up Chinese-linked attacks
A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate campaign against educational institutions in Africa and Latin America, mounted by Chinese-speaking operators.
Though the campaigns don’t appear to be connected, they are executed the same way: a human picks the targets and sets the goals, and a large language model (LLM) decides which commands to run and sends them to an implant on the victim’s network.
ARTEX widens Vapor Panda’s net
The China-nexus group CrowdStrike tracks as Vapor Panda started using an agentic framework called ARTEX on October 17. Over the next 11 days, a single ARTEX controller was used against organizations in at least 14 countries, the company determined.
Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, US defense and semiconductor companies, and telecom providers.
CrowdStrike confirmed post-exploitation activity at nine organizations, where the group installed the BloodAlchemy backdoor. It also saw password spraying against at least 12 others, including US think tanks and European government bodies.
The ARTEX framework ran mostly on DeepSeek, along with a second commercial LLM that CrowdStrike couldn’t identify. A main agent handed work to planner and worker agents, which keep track of what they’ve learned in a shared graph.
In one intrusion alone, the planning agents went through roughly 1.4 billion input tokens. Recovered transcripts show the operator stepping in at decision points with instructions written in Chinese.
When one route failed, the agents moved on to another, but the techniques they use were familiar.
At one pharma firm, the agent paired an unsigned SAML assertion with an XXE flaw to reach the cloud instance metadata service, then worked its way up to an enterprise admin account.
“Against a Greek government entity, the operator supplied the agent with a 2022 directory export from the organization’s mail server containing authentication keys that had likely not been rotated since the export. The agent used those keys to forge an administrator token and read mailboxes, then used VPN configurations recovered from a user’s sent mail, alongside a VPN client key the operator described as originating from a May 2024 email leak, to reach the internal network,” the company added.
This is the first time CrowdStrike has seen Vapor Panda use AI tooling, and the group’s target list has grown with it. This finding and Microsoft’s recent report about separate ARTEX activity by the Storm-0940 group seems to point to the ARTEX framework catching on among China-nexus groups, Crowdstrike noted.
Domain admin in days
Kaspersky’s report covers a smaller campaign against educational institutions in several African and Latin American countries.
The attackers used CyberStrikeAI, an open-source penetration testing framework written in Go. The LLM runs on the attacker’s command-and-control (C2) server, where it plans the next steps and generates commands. The implant on the victim’s machine has no AI built in and simply executes what it receives.
The attackers broke in “by hand” through a compromised SQL Server, spent about a day on reconnaissance, then went quiet for two weeks. But once the agent was installed, things moved fast: it set up persistence and did local recon within two minutes, then spent about five hours mapping the domain.
A few days later, lateral movement, credential dumping across multiple hosts and a database export took less than an hour. From agent deployment to the compromise of domain admin accounts, the whole thing took three to four days.
Kaspersky didn’t link the activity to a known group, but several clues point to a Chinese-speaking operator: Chinese comments in the scripts, use of the Chinese service dnslog[.]cn, and C2 server restarts that mostly happened during business hours in UTC+8.
“The origin of the tool itself also indirectly points in the same direction: CyberStrikeAI was developed within the Chinese cybersecurity community and is well known there,” Kaspersky researchers added.
What defenders should do now
Until recently, most documented attacker use of AI was preparation: writing phishing emails, fixing code, researching vulnerabilities. In these campaigns, the model is part of the intrusion itself.
“If HexStrike AI and similar tools cover the ‘find and break’ phase, and Sliver/Mythic/Havoc cover the ‘establish a foothold and control’ phase, CyberStrikeAI completes the kill chain: a single server-side process written in Go executes utilities via MCP, handles webshell connections, and assigns tasks to the implant, while the model analyzes the results and decides what to do next,” Kaspersky researchers say.
“The key takeaway is that the introduction of AI into the attack chain does not yet present fundamentally new challenges for detection. All the ‘intelligent’ work remains on the attacker’s side, while the compromised host is subjected to familiar actions: from reconnaissance via Kerberoasting and AS-REP Roasting to LSASS dumps, DCSync, and the Golden Ticket attacks.”
The novelty in these attacks is the speed and ease with which they were executed, they added.
CrowdStrike notes that detection only helps where it’s deployed, and these operators went looking for the gaps. It advises organizations rotate keys and credentials after any suspected exposure, enforce SAML signature validation and IMDSv2, hunt for ARTEX markers, patch internet-facing appliances, and run EDR everywhere.
“China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs, and enabling small teams to quickly scale intrusions across many targets simultaneously,” the company concluded.
Kaspersky researchers also expect the techniques these tools use to grow more sophisticated as models improve, and the operator’s job to shift “from setting tasks to monitoring the model’s actions.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
